From: Eric Leblond <el@stamus-networks.com>
Date: Tue, 23 Mar 2021 22:06:41 +0000 (+0100)
Subject: stream: flag TCP streams with gap
X-Git-Tag: suricata-7.0.0-beta1~113
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e6768118dacf60fdb452695babd7a91cca66a4ab;p=thirdparty%2Fsuricata.git

stream: flag TCP streams with gap
---

diff --git a/src/stream-tcp-private.h b/src/stream-tcp-private.h
index e817533d7a..2a7b124223 100644
--- a/src/stream-tcp-private.h
+++ b/src/stream-tcp-private.h
@@ -206,7 +206,8 @@ enum TcpState {
  * Per STREAM flags
  */
 
-// bit 0 vacant
+/** Flag to indicate that we have seen gap on the stream */
+#define STREAMTCP_STREAM_FLAG_HAS_GAP BIT_U16(0)
 /** Flag to avoid stream reassembly/app layer inspection for the stream */
 #define STREAMTCP_STREAM_FLAG_NOREASSEMBLY                  BIT_U16(1)
 /** we received a keep alive */
diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c
index 5f4032cc30..e6f7fbaf8d 100644
--- a/src/stream-tcp-reassemble.c
+++ b/src/stream-tcp-reassemble.c
@@ -1213,6 +1213,7 @@ static int ReassembleUpdateAppLayer (ThreadVars *tv,
             AppLayerProfilingStore(ra_ctx->app_tctx, p);
 
             StreamTcpSetEvent(p, STREAM_REASSEMBLY_SEQ_GAP);
+            (*stream)->flags |= STREAMTCP_STREAM_FLAG_HAS_GAP;
             StatsIncr(tv, ra_ctx->counter_tcp_reass_gap);
             ssn->lossy_be_liberal = true;